Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Feb 19, 2026NewsBlogger: Cross-Site Request ForgeryCVE-2025-12821 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is due to a reverted fix of CVE-2025-1305.
- Product
- NewsBlogger
- What to do
- Update NewsBlogger to the newest version.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Dec 31, 2025Logger for Elementor: Missing AuthorizationCVE-2025-66146 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logger for Elementor: from n/a through <= 1.0.9.
- Product
- Logger for Elementor
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Logger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2025WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file uploads when importing recipesCVE-2025-11755 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE).
- Product
- WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 16, 2025Developer Loggers for Simple History: Local File InclusionCVE-2025-10050 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.5 via the enabled_loggers parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- Developer Loggers for Simple History
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Developer Loggers for Simple History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 14, 2025Blogger Buzz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54680 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Blogger Buzz blogger-buzz allows Stored XSS.This issue affects Blogger Buzz: from n/a through <= 1.2.6.
- Product
- Blogger Buzz
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Cron Logger: Missing AuthorizationCVE-2025-53266 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cron Logger: from n/a through <= 1.3.0.
- Product
- Cron Logger
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Cron Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2025Yougler Blogger Profile Page: Cross-Site Request ForgeryCVE-2025-6062 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Yougler Blogger Profile Page
- Affected
- up to v1.01
- What to do
- Affects up to v1.01. Update Yougler Blogger Profile Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 1, 2025NewsBlogger: Cross-Site Request ForgeryCVE-2025-1305 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- NewsBlogger
- Affected
- up to 0.2.5.4
- What to do
- Affects up to 0.2.5.4. Update NewsBlogger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
May 1, 2025NewsBlogger: Arbitrary file uploadsCVE-2025-1304 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- NewsBlogger
- Affected
- up to 0.2.5.1
- What to do
- Affects up to 0.2.5.1. Update NewsBlogger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Apr 17, 2025WP Logger: Missing AuthorizationCVE-2025-39456 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in iTRON WP Logger wp-data-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Logger: from n/a through <= 2.2.
- Product
- WP Logger
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WP Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Login Logger: Cross-Site Request Forgery (CSRF)CVE-2025-28866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from n/a through <= 1.2.1.
- Product
- Login Logger
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Login Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025SEO Blogger to WordPress Migration using 301 Redirection: Reflected Cross-Site ScriptingCVE-2024-13422 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SEO Blogger to WordPress Migration using 301 Redirection
- Affected
- up to 0.4.8
- What to do
- Affects up to 0.4.8. Update SEO Blogger to WordPress Migration using 301 Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2025Blogger Image Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23689 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a.
- Product
- Blogger Image Import
- What to do
- Update Blogger Image Import to the newest version.
Dec 9, 2024Blogger Buzz: Missing AuthorizationCVE-2023-30476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.
- Product
- Blogger Buzz
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Blogger 301 Redirect: Blind time-based SQL InjectionCVE-2024-10645 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Blogger 301 Redirect plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘br’ parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Blogger 301 Redirect
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Blogger 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 11, 2024WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file movement and readingCVE-2024-7626 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
- Product
- WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2023Lana Email Logger: Stored Cross-Site ScriptingCVE-2023-3166 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, Lana Email Logger due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Lana Email Logger
- Affected
- up to Lana
- What to do
- Affects up to Lana. Update Lana Email Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 4, 2023A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress.CVE-2013-10027 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.
- Product
- Blogger Importer
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Blogger Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2022Search Logger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3131 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Search Logger WordPress plugin through 0.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- Search Logger
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Search Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021JH 404 Logger: Doesn't sanitise the referer and path of 404 pagesCVE-2021-24176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
- Product
- JH 404 Logger
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update JH 404 Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordganofins.comwpscan.com
Mar 7, 2018inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt.CVE-2018-7204 · WordPress plugins & themes · reported by MITREHigh 7.5
inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites.
- Product
- inc/logger.php in the Giribaz File Manager
- Fixed in
- 5.0.2
- What to do
- Update inc/logger.php in the Giribaz File Manager to 5.0.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.